Using HTTP Basic Auth in 2022
joeldare.com
Using HTTP Basic Auth in 2022
1–10 of 345 posts
Re: Using HTTP Basic Auth in 2022
#2How do you logout?
Re: Using HTTP Basic Auth in 2022
#3This is perfectly fine. Nothing to be ashamed of.
At least you don’t need to create a logon form
Re: Using HTTP Basic Auth in 2022
#4How do you logout?
You can still apply a session id to the client and destroy the session after the user clicked on logout…
Re: Using HTTP Basic Auth in 2022
#5How do you logout?
Great question. This is a downside, there is no built-in method, but there are some tricks. If I remember correctly you can send headers with incorrect credentials. I’ll have to do some research and add that to my template.
Re: Using HTTP Basic Auth in 2022
#6How do you logout?
While your point is correct: It's not design with a logout in mind, but you can do it. For instance clicking link that will send invalid credentials, that will return a 401 and work like a logout.
Mostly I just close my browser, that clear everything in my setup.
Re: Using HTTP Basic Auth in 2022
#7How do you logout?
Send an ajax request to your api with invalid credentials. The response returns a 401 and loggs the user out. Then redirect to the pre-login page.
Re: Using HTTP Basic Auth in 2022
#8How do you logout?
[deleted]
Re: Using HTTP Basic Auth in 2022
#9Re: Using HTTP Basic Auth in 2022
#10This is perfectly fine. Nothing to be ashamed of. At least you don’t need to create a logon form
But if you are rolling your own auth, you still need to create the signup, change password, reset password, confirm account, delete account, etc. pages. What's one more? Given that a logon form is >5% of the total amount of work to roll auth, seems kinda pointless to use this.